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access control element according to the priority of the type of each access control specifier, one 
or more characteristics of a packet are matched with the access control specifiers, one of the 
matches is selected according to the access control specifier with the highest associated priority, 
and the selected packet is processed. Types of access control specifiers correspond to the 
information in an access control entry. In one aspect of the present invention, an access control 
element is a content addressable memory. In another aspect of the present invention, the 
matching and processing are performed in parallel. In a further aspect of the present invention, 
the characteristics of the packet include one or more of a source address, a destination address, a 
source port, a destination port, a protocol type, an input interface and an output interface. In 
another aspect of the present invention, one or more of the access control specifiers are identified 
based on the matching and the identified access control specifiers are prioritized based on the 
matching. 

The present invention further provides a system for processing a packet. The system 
includes one or more access control specifiers, an access control element, and a priority encoder. 
The access control specifiers are have a plurality of types and those types are related to 
information in an access control entry. The access control element is configured to store the 
access control specifiers according to the priority of each access control specifier and to match 
one or more characteristics of a packet with the access control specifiers. The priority encoder is 
configured to select the highest priority match from among the matches. In one aspect of the 
present invention, the access control specifier further includes a label match mask for 
determining whetlier a first bit of the packet chaiacteristics is tested and a label match pattern for 
comparing to a second bit of the packet characteristics. In another aspect of the present 
invention, a processor is coupled to the access control element to process a packet not otherwise 
processed by the access control element. 

The present invention also provides a system for processing a packet that includes a 
means for configuring a plurality of access control specifiers in an access control element 
according to a priority of a type of each access control specifier, a means for matching one or 
more characteristics of the packet with one or more of the access control speci fiers, and a means 
for processing the packet based on the matching. 
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The present invention further provides a system that includes a means for maintaining a 
set of access control patterns, means for receiving a packet label responsible to a packet, means 
for matching matchable information responsive to the packet and the access control patterns, 
means for generating a set of matches in response to the means for matching, means for selecting 
at least one of the matches in response to priority information in the set of matches and 
generating an access result in response thereto, and a means for making a routing decision based 
on the access result. 

The present invention also provides a method for processing a packet that includes 
selecting an output interface to which to forward the packet, determining forwarding permission 
for the packet by matching one or more characteristics of the packet with one or more access 
control specifiers, and processing the packet based on the forwarding permission, wherein the 
selecting and the determining are performed in parallel. 
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